CVE-2020-3504 : A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager So

A vulnerability in the local management (local-mgmt) CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of CLI command parameters. An attacker could exploit this vulnerability by executing specific commands on the local-mgmt CLI on an affected device. A successful exploit could allow the attacker to cause internal system processes to fail to terminate properly, which could result in a buildup of stuck processes and lead to slowness in accessing the UCS Manager CLI and web UI. A sustained attack may result in a restart of internal UCS Manager processes and a temporary loss of access to the UCS Manager CLI and web UI.

Published 2020-08-27 16:15:12

Updated 2023-04-20 15:12:08

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2020-3504

Cisco » Nx-os
Versions from including (>=) 4.0 and before (<) 4.0\(4i\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Ucs 64108 » Version: N/A
When used together with: Cisco » Ucs 6454 » Version: N/A
Cisco » Nx-os » Version: N/A
cpe:2.3:o:cisco:nx-os:-:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Mds 9100 » Version: N/A
When used together with: Cisco » Mds 9200 » Version: N/A
When used together with: Cisco » Mds 9500 » Version: N/A
When used together with: Cisco » Mds 9700 » Version: N/A
When used together with: Cisco » Nexus 1000 Virtual Edge » Version: N/A
When used together with: Cisco » Nexus 1000v » Version: N/A
When used together with: Cisco » Nexus 3016 » Version: N/A
When used together with: Cisco » Nexus 3048 » Version: N/A
When used together with: Cisco » Nexus 3064 » Version: N/A
When used together with: Cisco » Nexus 3064-t » Version: N/A
When used together with: Cisco » Nexus 31108pc-v » Version: N/A
When used together with: Cisco » Nexus 31108tc-v » Version: N/A
When used together with: Cisco » Nexus 31128pq » Version: N/A
When used together with: Cisco » Nexus 3132c-z » Version: N/A
When used together with: Cisco » Nexus 3132q » Version: N/A
When used together with: Cisco » Nexus 3132q-v » Version: N/A
When used together with: Cisco » Nexus 3132q-xl » Version: N/A
When used together with: Cisco » Nexus 3164q » Version: N/A
When used together with: Cisco » Nexus 3172 » Version: N/A
When used together with: Cisco » Nexus 3172pq-xl » Version: N/A
When used together with: Cisco » Nexus 3172tq » Version: N/A
When used together with: Cisco » Nexus 3172tq-32t » Version: N/A
When used together with: Cisco » Nexus 3172tq-xl » Version: N/A
When used together with: Cisco » Nexus 3232c » Version: N/A
When used together with: Cisco » Nexus 3264c-e » Version: N/A
When used together with: Cisco » Nexus 3264q » Version: N/A
When used together with: Cisco » Nexus 3408-s » Version: N/A
When used together with: Cisco » Nexus 34180yc » Version: N/A
When used together with: Cisco » Nexus 3432d-s » Version: N/A
When used together with: Cisco » Nexus 3464c » Version: N/A
When used together with: Cisco » Nexus 3524 » Version: N/A
When used together with: Cisco » Nexus 3524-x » Version: N/A
When used together with: Cisco » Nexus 3524-xl » Version: N/A
When used together with: Cisco » Nexus 3548 » Version: N/A
When used together with: Cisco » Nexus 3548-x » Version: N/A
When used together with: Cisco » Nexus 3548-xl » Version: N/A
When used together with: Cisco » Nexus 36180yc-r » Version: N/A
When used together with: Cisco » Nexus 3636c-r » Version: N/A
When used together with: Cisco » Nexus 5548p » Version: N/A
When used together with: Cisco » Nexus 5548up » Version: N/A
When used together with: Cisco » Nexus 5596t » Version: N/A
When used together with: Cisco » Nexus 5596up » Version: N/A
When used together with: Cisco » Nexus 56128p » Version: N/A
When used together with: Cisco » Nexus 5624q » Version: N/A
When used together with: Cisco » Nexus 5648q » Version: N/A
When used together with: Cisco » Nexus 5672up » Version: N/A
When used together with: Cisco » Nexus 5696q » Version: N/A
When used together with: Cisco » Nexus 6001 » Version: N/A
When used together with: Cisco » Nexus 6004 » Version: N/A
When used together with: Cisco » Nexus 7000 » Version: N/A
When used together with: Cisco » Nexus 7700 » Version: N/A
When used together with: Cisco » Nexus 9000v » Version: N/A
When used together with: Cisco » Nexus 92160yc-x » Version: N/A
When used together with: Cisco » Nexus 92300yc » Version: N/A
When used together with: Cisco » Nexus 92304qc » Version: N/A
When used together with: Cisco » Nexus 92348gc-x » Version: N/A
When used together with: Cisco » Nexus 9236c » Version: N/A
When used together with: Cisco » Nexus 9272q » Version: N/A
When used together with: Cisco » Nexus 93108tc-ex » Version: N/A
When used together with: Cisco » Nexus 93108tc-fx » Version: N/A
When used together with: Cisco » Nexus 93120tx » Version: N/A
When used together with: Cisco » Nexus 93128tx » Version: N/A
When used together with: Cisco » Nexus 93180lc-ex » Version: N/A
When used together with: Cisco » Nexus 93180yc-ex » Version: N/A
When used together with: Cisco » Nexus 93180yc-fx » Version: N/A
When used together with: Cisco » Nexus 93216tc-fx2 » Version: N/A
When used together with: Cisco » Nexus 93240yc-fx2 » Version: N/A
When used together with: Cisco » Nexus 9332c » Version: N/A
When used together with: Cisco » Nexus 9332pq » Version: N/A
When used together with: Cisco » Nexus 93360yc-fx2 » Version: N/A
When used together with: Cisco » Nexus 9336c-fx2 » Version: N/A
When used together with: Cisco » Nexus 9336pq Aci Spine » Version: N/A
When used together with: Cisco » Nexus 9348gc-fxp » Version: N/A
When used together with: Cisco » Nexus 9364c » Version: N/A
When used together with: Cisco » Nexus 9372px » Version: N/A
When used together with: Cisco » Nexus 9372px-e » Version: N/A
When used together with: Cisco » Nexus 9372tx » Version: N/A
When used together with: Cisco » Nexus 9372tx-e » Version: N/A
When used together with: Cisco » Nexus 9396px » Version: N/A
When used together with: Cisco » Nexus 9396tx » Version: N/A
When used together with: Cisco » Nexus 9504 » Version: N/A
When used together with: Cisco » Nexus 9508 » Version: N/A
When used together with: Cisco » Nexus 9516 » Version: N/A
When used together with: Cisco » Ucs 6248up » Version: N/A
When used together with: Cisco » Ucs 6296up » Version: N/A
When used together with: Cisco » Ucs 6300 » Version: N/A
When used together with: Cisco » Ucs 6324 » Version: N/A
Cisco » Firepower Extensible Operating System » Version: N/A
cpe:2.3:o:cisco:firepower_extensible_operating_system:-:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Firepower 1010 » Version: N/A
When used together with: Cisco » Firepower 1120 » Version: N/A
When used together with: Cisco » Firepower 1140 » Version: N/A
When used together with: Cisco » Firepower 1150 » Version: N/A
When used together with: Cisco » Firepower 2110 » Version: N/A
When used together with: Cisco » Firepower 2120 » Version: N/A
When used together with: Cisco » Firepower 2130 » Version: N/A
When used together with: Cisco » Firepower 2140 » Version: N/A
When used together with: Cisco » Firepower 4110 » Version: N/A
When used together with: Cisco » Firepower 4112 » Version: N/A
When used together with: Cisco » Firepower 4115 » Version: N/A
When used together with: Cisco » Firepower 4120 » Version: N/A
When used together with: Cisco » Firepower 4125 » Version: N/A
When used together with: Cisco » Firepower 4140 » Version: N/A
When used together with: Cisco » Firepower 4145 » Version: N/A
When used together with: Cisco » Firepower 4150 » Version: N/A
When used together with: Cisco » Firepower 9300 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-3504

EPSS FAQ

0.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 35 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-3504

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:N/I:N/A:P	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
3.3	LOW	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L	1.8	1.4	Cisco Systems, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low
3.3	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L	1.8	1.4	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: Low

CWE ids for CVE-2020-3504

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

Assigned by: nvd@nist.gov (Primary)
CWE-664 Improper Control of a Resource Through its Lifetime

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Assigned by: ykramarz@cisco.com (Secondary)

References for CVE-2020-3504

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-cli-dos-GQUxCnTe

Cisco UCS Manager Software Local Management CLI Denial of Service Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-3504

Products affected by CVE-2020-3504

Exploit prediction scoring system (EPSS) score for CVE-2020-3504

CVSS scores for CVE-2020-3504

CWE ids for CVE-2020-3504

References for CVE-2020-3504